Update spire-identity-exchange for 0.4.0 (#900)
* Update spire-identity-exchange for 0.4.0 Signed-off-by: Kevin Fox <[email protected]> * Understand the plugin config Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update ip Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Fix broken socket path Signed-off-by: Kevin Fox <[email protected]> * Nope, it was right before Signed-off-by: Kevin Fox <[email protected]> * Try disabling the spiffe plugin for now Signed-off-by: Kevin Fox <[email protected]> * Try logging more Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Add missing csi driver settings Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Use local oidc discovery provider path by default Signed-off-by: Kevin Fox <[email protected]> * Enable spire-identity-exchange in shared infrastructure Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump spire-ha-agent version to fix issue Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Update version bits to match what it should be, minus final bump Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
+260
-161
@@ -199,43 +199,134 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.caSubject.country` | Country for Spire server CA | `""` |
|
||||
| `global.spire.caSubject.organization` | Organization for Spire server CA | `""` |
|
||||
| `global.spire.caSubject.commonName` | Common Name for Spire server CA | `""` |
|
||||
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
|
||||
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
|
||||
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |
|
||||
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
|
||||
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
|
||||
| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` |
|
||||
| `global.spire.recommendations.prometheus` | Enable prometheus exporters for monitoring | `true` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.namespaces.create` | Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created. | `false` |
|
||||
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
|
||||
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
|
||||
| `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` |
|
||||
| `global.spire.namespaces.system.labels` | Labels to apply to the Spire system Namespace. | `{}` |
|
||||
| `global.spire.namespaces.server.name` | Name of the Spire server Namespace. | `spire-server` |
|
||||
| `global.spire.namespaces.server.create` | Create a Namespace for Spire server resources. | `false` |
|
||||
| `global.spire.namespaces.server.annotations` | Annotations to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.namespaces.server.labels` | Labels to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `global.spire.tools.kubectl.tag` | Set to force the tag to use for all kubectl instances | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `tags.nestedRoot` | Set the chart architecture to root nested | `false` |
|
||||
| `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` |
|
||||
| `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` |
|
||||
| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` |
|
||||
| `tags.bottomTurtleHAA` | Setup HA side A for use with a Bottom Turtle architecture | `false` |
|
||||
| `tags.bottomTurtleHAB` | Setup HA side B for use with a Bottom Turtle architecture | `false` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.caSubject.country` | Country for Spire server CA | `""` |
|
||||
| `global.spire.caSubject.organization` | Organization for Spire server CA | `""` |
|
||||
| `global.spire.caSubject.commonName` | Common Name for Spire server CA | `""` |
|
||||
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
|
||||
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
|
||||
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |
|
||||
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
|
||||
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
|
||||
| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` |
|
||||
| `global.spire.recommendations.prometheus` | Enable prometheus exporters for monitoring | `true` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.namespaces.create` | Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created. | `false` |
|
||||
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
|
||||
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
|
||||
| `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` |
|
||||
| `global.spire.namespaces.system.labels` | Labels to apply to the Spire system Namespace. | `{}` |
|
||||
| `global.spire.namespaces.server.name` | Name of the Spire server Namespace. | `spire-server` |
|
||||
| `global.spire.namespaces.server.create` | Create a Namespace for Spire server resources. | `false` |
|
||||
| `global.spire.namespaces.server.annotations` | Annotations to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.namespaces.server.labels` | Labels to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `global.spire.gatewayAPI.manageListenerSets` | Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled. | `true` |
|
||||
| `global.spire.gatewayAPI.gateway.name` | Name of the shared Gateway object that routes and ListenerSets attach to | `spire` |
|
||||
| `global.spire.gatewayAPI.gateway.namespace` | Namespace of the shared Gateway object. Defaults to the release namespace if blank. | `spire-server` |
|
||||
| `global.spire.gatewayAPI.gateway.port` | Port the shared Gateway listens on. ListenerSet listeners must match this. | `443` |
|
||||
| `global.spire.tools.kubectl.tag` | Set to force the tag to use for all kubectl instances | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `tags.nestedRoot` | Set the chart architecture to root nested | `false` |
|
||||
| `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` |
|
||||
| `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` |
|
||||
| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` |
|
||||
| `tags.bottomTurtleHAA` | Setup HA side A for use with a Bottom Turtle architecture | `false` |
|
||||
| `tags.bottomTurtleHAB` | Setup HA side B for use with a Bottom Turtle architecture | `false` |
|
||||
| `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` |
|
||||
| `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` |
|
||||
| `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` |
|
||||
| `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` |
|
||||
| `spireIdentityExchange.podSelector` | Labels selecting the exchange pods of both sides. Narrow it (for example by adding release-namespace) when other exchanges share the namespace. | `{}` |
|
||||
| `spireIdentityExchange.tls.rest.enabled` | Expose the combined REST endpoint served with the on-disk certificate | `false` |
|
||||
| `spireIdentityExchange.tls.rest.service.type` | Service type | `ClusterIP` |
|
||||
| `spireIdentityExchange.tls.rest.service.port` | port for the service | `443` |
|
||||
| `spireIdentityExchange.tls.rest.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `spireIdentityExchange.tls.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.className` | Ingress class name | `""` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts. | `spire-identity-exchange-rest` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `spireIdentityExchange.tls.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `spireIdentityExchange.tls.rest.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
||||
| `spireIdentityExchange.tls.grpc.enabled` | Expose the combined gRPC endpoint served with the on-disk certificate | `false` |
|
||||
| `spireIdentityExchange.tls.grpc.service.type` | Service type | `ClusterIP` |
|
||||
| `spireIdentityExchange.tls.grpc.service.port` | port for the service | `443` |
|
||||
| `spireIdentityExchange.tls.grpc.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `spireIdentityExchange.tls.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.className` | Ingress class name | `""` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts. | `spire-identity-exchange-grpc` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `spireIdentityExchange.tls.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `spireIdentityExchange.tls.grpc.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
||||
| `spireIdentityExchange.spiffe.rest.enabled` | Expose the combined REST endpoint served with each side's own X509-SVID | `false` |
|
||||
| `spireIdentityExchange.spiffe.rest.service.type` | Service type | `ClusterIP` |
|
||||
| `spireIdentityExchange.spiffe.rest.service.port` | port for the service | `443` |
|
||||
| `spireIdentityExchange.spiffe.rest.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `spireIdentityExchange.spiffe.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.className` | Ingress class name | `""` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts. | `spire-identity-exchange-rest-spiffe` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `spireIdentityExchange.spiffe.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `spireIdentityExchange.spiffe.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
||||
| `spireIdentityExchange.spiffe.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest-spiffe` |
|
||||
| `spireIdentityExchange.spiffe.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `spireIdentityExchange.spiffe.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `spireIdentityExchange.spiffe.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `spireIdentityExchange.spiffe.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `spireIdentityExchange.spiffe.grpc.enabled` | Expose the combined gRPC endpoint served with each side's own X509-SVID | `false` |
|
||||
| `spireIdentityExchange.spiffe.grpc.service.type` | Service type | `ClusterIP` |
|
||||
| `spireIdentityExchange.spiffe.grpc.service.port` | port for the service | `443` |
|
||||
| `spireIdentityExchange.spiffe.grpc.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `spireIdentityExchange.spiffe.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.className` | Ingress class name | `""` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts. | `spire-identity-exchange-grpc-spiffe` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `spireIdentityExchange.spiffe.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `spireIdentityExchange.spiffe.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
||||
| `spireIdentityExchange.spiffe.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc-spiffe` |
|
||||
| `spireIdentityExchange.spiffe.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `spireIdentityExchange.spiffe.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `spireIdentityExchange.spiffe.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `spireIdentityExchange.spiffe.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
|
||||
### Spire agent parameters
|
||||
|
||||
@@ -384,130 +475,138 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Spire server parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ----------------------------------------------------------------------------- |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.caKeyType` | Key type to use for the ca | `ec-p256` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.experimental.enabled` | enable experimental features | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.experimental.agentSPIFFEIDAsSelector` | enable adding spiffe_id selectors to all agents | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.allowedIDPrefix` | The allowed ID prefix | `spire/agent/x509pop/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.serviceAccount` | The service account to allow in for dynamic registration | `spire-a-agent` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.parentIDTemplate` | parent id template | `spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-a.csi.spiffe.io` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.address` | Address for upstream Spire server | `spire-server-a` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.port` | The port setting of the root SPIRE server | `8081` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-server-a-bundle` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.trustSync.enabled` | Enable trust syncing | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.trustSync.domains` | the trust domains to sync | `["spire-ha"]` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ----------------------------------------------------------------------------- |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.caKeyType` | Key type to use for the ca | `ec-p256` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.experimental.enabled` | enable experimental features | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.experimental.agentSPIFFEIDAsSelector` | enable adding spiffe_id selectors to all agents | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.allowedIDPrefix` | The allowed ID prefix | `spire/agent/x509pop/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.serviceAccount` | The service account to allow in for dynamic registration | `spire-a-agent` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.parentIDTemplate` | parent id template | `spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-a.csi.spiffe.io` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.address` | Address for upstream Spire server | `spire-server-a` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.port` | The port setting of the root SPIRE server | `8081` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-server-a-bundle` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.trustSync.enabled` | Enable trust syncing | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.trustSync.domains` | the trust domains to sync | `["spire-ha"]` |
|
||||
|
||||
### Spire server parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------- |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.caKeyType` | Key type to use for the ca | `ec-p256` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.experimental.enabled` | enable experimental features | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.experimental.agentSPIFFEIDAsSelector` | enable adding spiffe_id selectors to all agents | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.allowedIDPrefix` | The allowed ID prefix | `spire/agent/x509pop/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.serviceAccount` | The service account to allow in for dynamic registration | `spire-b-agent` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.parentIDTemplate` | parent id template | `spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-b.csi.spiffe.io` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.address` | Address for upstream Spire server | `spire-server-b` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port` | The port setting of the root SPIRE server | `8081` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-server-b-bundle` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.trustSync.enabled` | Enable trust syncing | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.trustSync.domains` | the trust domains to sync | `["spire-ha"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-server-a-bundle` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent-a` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.nameOverride` | The name override to use to contact the server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent-a/public/api.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.keyManager.memory.enabled` | Enable the memory based Key Manager | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.enabled` | Enable the disk key manager | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.mode` | Where the disk plugin will write out its data | `emptyDir` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.healthChecks.port` | Health check port | `9981` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.telemetry.prometheus.port` | Prometheus port to use | `9989` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.socketPath` | Socket path to use | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.hostBasePath` | Path on the host to place sockets | `/var/run/spire/agent/sockets/a` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled` | Enable admin socket | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost` | Mount admin socket on host | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates` | List of workloads able to use the delegation api | `["/spire-ha-agent"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy` | The default accessPolicy | `permissive` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-server-b-bundle` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent-b` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.nameOverride` | The name override to use to contact the server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent-b/public/api.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.keyManager.memory.enabled` | Enable the memory based Key Manager | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.enabled` | Enable the disk key manager | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.mode` | Where the disk plugin will write out its data | `emptyDir` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.healthChecks.port` | Health check port | `9982` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.telemetry.prometheus.port` | Prometheus port to use | `9990` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.socketPath` | Socket path to use | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.hostBasePath` | Path on the host to place sockets | `/var/run/spire/agent/sockets/b` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled` | Enable admin socket | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost` | Mount admin socket on host | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates` | List of workloads able to use the delegation api | `["/spire-ha-agent"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy` | The default accessPolicy | `permissive` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride` | Fullname override | `spiffe-csi-driver-downstream-a` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName` | The name of the plugin instance | `a.csi.spiffe.io` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port` | The health check port | `9814` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride` | Fullname override | `spiffe-csi-driver-downstream-b` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName` | The name of the plugin instance | `b.csi.spiffe.io` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port` | The health check port | `9816` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.csiDriverName` | CSI driver name to use | `a.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-grpc` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.csiDriverName` | CSI driver name to use | `b.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-grpc` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.caKeyType` | Key type to use for the ca | `ec-p256` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.experimental.enabled` | enable experimental features | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.experimental.agentSPIFFEIDAsSelector` | enable adding spiffe_id selectors to all agents | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.allowedIDPrefix` | The allowed ID prefix | `spire/agent/x509pop/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.serviceAccount` | The service account to allow in for dynamic registration | `spire-b-agent` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.parentIDTemplate` | parent id template | `spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-b.csi.spiffe.io` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.address` | Address for upstream Spire server | `spire-server-b` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port` | The port setting of the root SPIRE server | `8081` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-server-b-bundle` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.trustSync.enabled` | Enable trust syncing | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.trustSync.domains` | the trust domains to sync | `["spire-ha"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-server-a-bundle` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent-a` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.nameOverride` | The name override to use to contact the server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent-a/public/api.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.keyManager.memory.enabled` | Enable the memory based Key Manager | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.enabled` | Enable the disk key manager | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.mode` | Where the disk plugin will write out its data | `emptyDir` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.healthChecks.port` | Health check port | `9981` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.telemetry.prometheus.port` | Prometheus port to use | `9989` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.socketPath` | Socket path to use | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.hostBasePath` | Path on the host to place sockets | `/var/run/spire/agent/sockets/a` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled` | Enable admin socket | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost` | Mount admin socket on host | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates` | List of workloads able to use the delegation api | `["/spire-ha-agent"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy` | The default accessPolicy | `permissive` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-server-b-bundle` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent-b` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.enabled` | Enable dynamic registration | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.nameOverride` | The name override to use to contact the server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent-b/public/api.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.keyManager.memory.enabled` | Enable the memory based Key Manager | `false` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.enabled` | Enable the disk key manager | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.mode` | Where the disk plugin will write out its data | `emptyDir` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.healthChecks.port` | Health check port | `9982` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.telemetry.prometheus.port` | Prometheus port to use | `9990` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.socketPath` | Socket path to use | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.hostBasePath` | Path on the host to place sockets | `/var/run/spire/agent/sockets/b` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled` | Enable admin socket | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost` | Mount admin socket on host | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates` | List of workloads able to use the delegation api | `["/spire-ha-agent"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy` | The default accessPolicy | `permissive` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride` | Fullname override | `spiffe-csi-driver-downstream-a` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName` | The name of the plugin instance | `a.csi.spiffe.io` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port` | The health check port | `9814` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride` | Fullname override | `spiffe-csi-driver-downstream-b` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName` | The name of the plugin instance | `b.csi.spiffe.io` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port` | The health check port | `9816` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.csiDriverName` | CSI driver name to use | `a.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.tls.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.tls.grpc.ingress.host` | Hostname override for the grpc ingress service | `spire-identity-exchange-a-grpc` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.spiffe.rest.ingress.host` | Hostname override for the SVID-served rest ingress service | `spire-identity-exchange-a-rest-spiffe` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.spiffe.grpc.ingress.host` | Hostname override for the SVID-served grpc ingress service | `spire-identity-exchange-a-grpc-spiffe` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.csiDriverName` | The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid. | `csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.config.discoveryURL` | The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply. | `https://spiffe-oidc-discovery-provider` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.csiDriverName` | CSI driver name to use | `b.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.tls.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.tls.grpc.ingress.host` | Hostname override for the grpc ingress service | `spire-identity-exchange-b-grpc` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.spiffe.rest.ingress.host` | Hostname override for the SVID-served rest ingress service | `spire-identity-exchange-b-rest-spiffe` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.spiffe.grpc.ingress.host` | Hostname override for the SVID-served grpc ingress service | `spire-identity-exchange-b-grpc-spiffe` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.csiDriverName` | The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid. | `csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.config.discoveryURL` | The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply. | `https://spiffe-oidc-discovery-provider` |
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-nested.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-nested.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-nested.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-nested.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-nested.chart" . }}
|
||||
app.kubernetes.io/name: {{ include "spire-nested.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
The namespace the SPIRE server side components land in. Resolved the same way as
|
||||
spire-identity-exchange.namespace, so the combined exposure lands beside the exchange
|
||||
pods it selects — a Service selector is namespace scoped.
|
||||
*/}}
|
||||
{{- define "spire-nested.server-namespace" -}}
|
||||
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Base name for the combined identity exchange objects. Keyed on the release name so it
|
||||
reads like the per-side exchanges, which the sides' own releases name spire-a-identity-
|
||||
exchange / spire-b-identity-exchange — so these never collide with them either.
|
||||
*/}}
|
||||
{{- define "spire-nested.identity-exchange-name" -}}
|
||||
{{- printf "%s-identity-exchange" .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,3 @@
|
||||
{{- if .Values.gatewayAPI.gateway.enabled }}
|
||||
{{- include "spire-lib.gateway-resource" (dict "root" . "gatewayObject" .Values.gatewayAPI.gateway) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.grpc.enabled .Values.spireIdentityExchange.spiffe.grpc.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-grpc-spiffe" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{/* Passthrough only. These backends serve an X509-SVID, whose only SAN is a
|
||||
spiffe:// URI, so a BackendTLSPolicy hostname check could never match. */}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.spiffe.grpc.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.spiffe.grpc.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" "TLSRoute"
|
||||
"backendTLS" false) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.grpc.enabled .Values.spireIdentityExchange.spiffe.grpc.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.spiffe.grpc.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.spiffe.grpc.ingress) }}
|
||||
{{- $fullName := printf "%s-grpc-spiffe" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.spiffe.grpc.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.spiffe.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.spiffe.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.spiffe.grpc.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.grpc.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-grpc-spiffe
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.spiffe.grpc.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.spiffe.grpc.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.spiffe.grpc.service.type "LoadBalancer") .Values.spireIdentityExchange.spiffe.grpc.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.spiffe.grpc.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.spiffe.grpc.service.port }}
|
||||
targetPort: grpc-spiffe
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled .Values.spireIdentityExchange.spiffe.rest.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-rest-spiffe" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{/* Passthrough only. These backends serve an X509-SVID, whose only SAN is a
|
||||
spiffe:// URI, so a BackendTLSPolicy hostname check could never match. */}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.spiffe.rest.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.spiffe.rest.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" "TLSRoute"
|
||||
"backendTLS" false) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled .Values.spireIdentityExchange.spiffe.rest.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.spiffe.rest.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.spiffe.rest.ingress) }}
|
||||
{{- $fullName := printf "%s-rest-spiffe" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.spiffe.rest.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.spiffe.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.spiffe.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.spiffe.rest.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-rest-spiffe
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.spiffe.rest.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.spiffe.rest.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.spiffe.rest.service.type "LoadBalancer") .Values.spireIdentityExchange.spiffe.rest.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.spiffe.rest.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.spiffe.rest.service.port }}
|
||||
targetPort: rest-spiffe
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.grpc.enabled .Values.spireIdentityExchange.tls.grpc.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-grpc" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{- $routeKind := include "spire-lib.gateway-route-kind" (dict "gatewayAPI" .Values.spireIdentityExchange.tls.grpc.gatewayAPI) -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.tls.grpc.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.tls.grpc.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" (eq $routeKind "HTTPRoute")) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.grpc.enabled .Values.spireIdentityExchange.tls.grpc.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.tls.grpc.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.tls.grpc.ingress) }}
|
||||
{{- $fullName := printf "%s-grpc" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.tls.grpc.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.tls.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.tls.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.tls.grpc.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.grpc.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-grpc
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.tls.grpc.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.tls.grpc.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.tls.grpc.service.type "LoadBalancer") .Values.spireIdentityExchange.tls.grpc.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.tls.grpc.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.tls.grpc.service.port }}
|
||||
targetPort: grpc
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.rest.enabled .Values.spireIdentityExchange.tls.rest.gatewayAPI.enabled -}}
|
||||
{{- $fullName := printf "%s-rest" (include "spire-nested.identity-exchange-name" .) -}}
|
||||
{{- $routeKind := include "spire-lib.gateway-route-kind" (dict "gatewayAPI" .Values.spireIdentityExchange.tls.rest.gatewayAPI) -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.spireIdentityExchange.tls.rest.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-nested.server-namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.spireIdentityExchange.tls.rest.service.port
|
||||
"labels" (include "spire-nested.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" (eq $routeKind "HTTPRoute")) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.rest.enabled .Values.spireIdentityExchange.tls.rest.ingress.enabled -}}
|
||||
{{- $port := .Values.spireIdentityExchange.tls.rest.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.spireIdentityExchange.tls.rest.ingress) }}
|
||||
{{- $fullName := printf "%s-rest" (include "spire-nested.identity-exchange-name" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.spireIdentityExchange.tls.rest.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.spireIdentityExchange.tls.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if .Values.spireIdentityExchange.tls.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.spireIdentityExchange.tls.rest.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.tls.rest.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-nested.identity-exchange-name" . }}-rest
|
||||
namespace: {{ include "spire-nested.server-namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-nested.labels" . | nindent 4 }}
|
||||
{{- with .Values.spireIdentityExchange.tls.rest.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.spireIdentityExchange.tls.rest.service.type }}
|
||||
{{- if and (eq .Values.spireIdentityExchange.tls.rest.service.type "LoadBalancer") .Values.spireIdentityExchange.tls.rest.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.spireIdentityExchange.tls.rest.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.spireIdentityExchange.tls.rest.service.port }}
|
||||
targetPort: rest
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- toYaml .Values.spireIdentityExchange.podSelector | nindent 4 }}
|
||||
{{- end }}
|
||||
+305
-24
@@ -73,6 +73,24 @@ global:
|
||||
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
ingressControllerType: ""
|
||||
|
||||
## Shared Gateway that routes and ListenerSets attach to. The Gateway object itself is
|
||||
## rendered by the `gatewayAPI.gateway` block of this chart. Gateway API support is
|
||||
## independent of ingress and can be enabled alongside it.
|
||||
gatewayAPI:
|
||||
## @param global.spire.gatewayAPI.manageListenerSets Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled.
|
||||
manageListenerSets: true
|
||||
gateway:
|
||||
## @param global.spire.gatewayAPI.gateway.name Name of the shared Gateway object that routes and ListenerSets attach to
|
||||
name: spire
|
||||
## The Gateway object and every route's parentRef both read this value, so they
|
||||
## cannot disagree. It defaults to the server namespace so the Gateway sits with
|
||||
## the workloads it fronts; a ListenerSet in another namespace still attaches, as
|
||||
## the Gateway allows listeners from all namespaces by default.
|
||||
## @param global.spire.gatewayAPI.gateway.namespace Namespace of the shared Gateway object. Defaults to the release namespace if blank.
|
||||
namespace: spire-server
|
||||
## @param global.spire.gatewayAPI.gateway.port Port the shared Gateway listens on. ListenerSet listeners must match this.
|
||||
port: 443
|
||||
|
||||
tools:
|
||||
kubectl:
|
||||
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
|
||||
@@ -108,6 +126,233 @@ tags:
|
||||
## @param tags.bottomTurtleHAB Setup HA side B for use with a Bottom Turtle architecture
|
||||
bottomTurtleHAB: false
|
||||
|
||||
## The shared Gateway that routes and ListenerSets attach to. Only one release in a cluster
|
||||
## should render it. name/namespace/port come from global.spire.gatewayAPI.gateway; the
|
||||
## class and listener policy are local.
|
||||
##
|
||||
gatewayAPI:
|
||||
gateway:
|
||||
## @param gatewayAPI.gateway.enabled Render the shared Gateway object
|
||||
enabled: false
|
||||
## @param gatewayAPI.gateway.className gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.
|
||||
className: ""
|
||||
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
|
||||
annotations: {}
|
||||
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
|
||||
allowedListenersNamespaces: All
|
||||
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
|
||||
allowedRoutesNamespaces: All
|
||||
## @param gatewayAPI.gateway.extraListeners [array] Additional listeners to add to the Gateway
|
||||
extraListeners: []
|
||||
|
||||
## Combined exposure fronting the spire-identity-exchange of both HA sides. Only rendered
|
||||
## with tags.haAgentCommon; the per-side exposures under bottomTurtleHAA/B are untouched.
|
||||
## Each endpoint gets one Service selecting both sides' exchange pods, so the Ingress and
|
||||
## the Gateway API route need only a single backend. The matching listener must be enabled
|
||||
## on the sides themselves; if it is not, the Service simply has no endpoints.
|
||||
spireIdentityExchange:
|
||||
## @param spireIdentityExchange.podSelector [object] Labels selecting the exchange pods of both sides. Narrow it (for example by adding release-namespace) when other exchanges share the namespace.
|
||||
podSelector:
|
||||
component: spire-identity-exchange
|
||||
|
||||
## Endpoints served with the certificate each side loads from disk.
|
||||
tls:
|
||||
rest:
|
||||
## @param spireIdentityExchange.tls.rest.enabled Expose the combined REST endpoint served with the on-disk certificate
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.tls.rest.service.type Service type
|
||||
## @param spireIdentityExchange.tls.rest.service.port port for the service
|
||||
## @param spireIdentityExchange.tls.rest.service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.tls.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||
loadBalancerIP: ""
|
||||
ingress:
|
||||
## @param spireIdentityExchange.tls.rest.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.tls.rest.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param spireIdentityExchange.tls.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param spireIdentityExchange.tls.rest.ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.tls.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
||||
host: "spire-identity-exchange-rest"
|
||||
## @param spireIdentityExchange.tls.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
## @param spireIdentityExchange.tls.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
## @param spireIdentityExchange.tls.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-identity-exchange-rest"
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
||||
tlsSecret: ""
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
backendTLS:
|
||||
## @param spireIdentityExchange.tls.rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
||||
caCertificateRefs: []
|
||||
grpc:
|
||||
## @param spireIdentityExchange.tls.grpc.enabled Expose the combined gRPC endpoint served with the on-disk certificate
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.tls.grpc.service.type Service type
|
||||
## @param spireIdentityExchange.tls.grpc.service.port port for the service
|
||||
## @param spireIdentityExchange.tls.grpc.service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.tls.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||
loadBalancerIP: ""
|
||||
ingress:
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
||||
host: "spire-identity-exchange-grpc"
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
## @param spireIdentityExchange.tls.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-identity-exchange-grpc"
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
||||
tlsSecret: ""
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
backendTLS:
|
||||
## @param spireIdentityExchange.tls.grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
||||
caCertificateRefs: []
|
||||
|
||||
## Endpoints served with each side's own X509-SVID. Gateway API is always a TLSRoute
|
||||
## (SNI passthrough) here: an X509-SVID has no DNS SAN, so edge termination could never
|
||||
## validate these backends.
|
||||
spiffe:
|
||||
rest:
|
||||
## @param spireIdentityExchange.spiffe.rest.enabled Expose the combined REST endpoint served with each side's own X509-SVID
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.spiffe.rest.service.type Service type
|
||||
## @param spireIdentityExchange.spiffe.rest.service.port port for the service
|
||||
## @param spireIdentityExchange.spiffe.rest.service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.spiffe.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||
loadBalancerIP: ""
|
||||
ingress:
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
||||
host: "spire-identity-exchange-rest-spiffe"
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
## @param spireIdentityExchange.spiffe.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-identity-exchange-rest-spiffe"
|
||||
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
grpc:
|
||||
## @param spireIdentityExchange.spiffe.grpc.enabled Expose the combined gRPC endpoint served with each side's own X509-SVID
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.spiffe.grpc.service.type Service type
|
||||
## @param spireIdentityExchange.spiffe.grpc.service.port port for the service
|
||||
## @param spireIdentityExchange.spiffe.grpc.service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.spiffe.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||
loadBalancerIP: ""
|
||||
ingress:
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
||||
host: "spire-identity-exchange-grpc-spiffe"
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
## @param spireIdentityExchange.spiffe.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
||||
enabled: false
|
||||
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-identity-exchange-grpc-spiffe"
|
||||
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
## subcharts
|
||||
|
||||
## @section Spire agent parameters
|
||||
@@ -497,10 +742,10 @@ internal-spire-server-bottom-turtle-ha-a:
|
||||
spire-ha-agent:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||
enabled: true
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
persistence:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
|
||||
type: emptyDir
|
||||
@@ -579,10 +824,10 @@ internal-spire-server-bottom-turtle-ha-b:
|
||||
spire-ha-agent:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||
enabled: true
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
persistence:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
|
||||
type: emptyDir
|
||||
@@ -799,17 +1044,35 @@ spire-identity-exchange-bottom-turtle-ha-a:
|
||||
nameOverride: identity-exchange
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
|
||||
csiDriverName: a.csi.spiffe.io
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-grpc"
|
||||
tls:
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.tls.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.tls.grpc.ingress.host Hostname override for the grpc ingress service
|
||||
host: "spire-identity-exchange-a-grpc"
|
||||
spiffe:
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.spiffe.rest.ingress.host Hostname override for the SVID-served rest ingress service
|
||||
host: "spire-identity-exchange-a-rest-spiffe"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.spiffe.grpc.ingress.host Hostname override for the SVID-served grpc ingress service
|
||||
host: "spire-identity-exchange-a-grpc-spiffe"
|
||||
server:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
|
||||
nameOverride: internal-server
|
||||
auth:
|
||||
plugins:
|
||||
spiffe:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.csiDriverName The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid.
|
||||
csiDriverName: csi.spiffe.io
|
||||
config:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.config.discoveryURL The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply.
|
||||
discoveryURL: https://spiffe-oidc-discovery-provider
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-b:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
|
||||
@@ -821,11 +1084,29 @@ spire-identity-exchange-bottom-turtle-ha-b:
|
||||
server:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
|
||||
nameOverride: internal-server
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-grpc"
|
||||
tls:
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.tls.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.tls.grpc.ingress.host Hostname override for the grpc ingress service
|
||||
host: "spire-identity-exchange-b-grpc"
|
||||
spiffe:
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.spiffe.rest.ingress.host Hostname override for the SVID-served rest ingress service
|
||||
host: "spire-identity-exchange-b-rest-spiffe"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.spiffe.grpc.ingress.host Hostname override for the SVID-served grpc ingress service
|
||||
host: "spire-identity-exchange-b-grpc-spiffe"
|
||||
auth:
|
||||
plugins:
|
||||
spiffe:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.csiDriverName The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid.
|
||||
csiDriverName: csi.spiffe.io
|
||||
config:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.config.discoveryURL The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply.
|
||||
discoveryURL: https://spiffe-oidc-discovery-provider
|
||||
|
||||
Reference in New Issue
Block a user